Input validation error in Netty - CVE-2026-75595

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU141319

Input validation error in Netty - CVE-2026-75595

Published: August 8, 2026 / Updated: August 21, 2026


Vulnerability identifier: #VU141319
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-75595
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass mTLS requirements.

The vulnerability exists due to an incorrect offset check in io.netty.handler.ssl.SslClientHelloHandler#decode when parsing a fragmented TLS ClientHello whose handshake header spans multiple records. A remote attacker can send a specially crafted fragmented TLS ClientHello to bypass mTLS requirements.

This issue affects deployments where per-SNI SslContext selection is the only mTLS gate, the default SslContext is permissive, and no secondary peer-certificate verification exists at the application layer.


Affected software

Netty
PowerVC
IBM SPSS Analytic Server
Bamboo Data Center
Communications Service Catalog and Design
Guardium Data Protection
Oracle Communications Cloud Native Core Unified Data Repository

How to mitigate CVE-2026-75595

Install security update from vendor's website.

Netty - addressed in versions 4.1.137, 4.2.17
Bamboo Data Center - addressed in versions 10.2.22, 12.1.11
Guardium Data Protection - update to 12.2.3

External References

Related Security Bulletins